A Falcon Administrator is trying to use Real-Time Response to start a session with a host that has a sensor installed but they are unable to connect. What is the most likely cause?

The correct answer is C. They do not have an RTR role assigned to them. The most likely cause for not being able to use Real-Time Response to start a session with a host that has a sensor installed is that they do not have an RTR role assigned to them. An RTR (Real Time Response) role is a role that grants access and permissions to use the Real…

Real-Time Response

Question

Options

AThe host has a user logged into it
BThe domain controller is preventing the connection
CThey do not have an RTR role assigned to them
DThere is another analyst connected into it

How the community answered

(58 responses)

A
12% (7)
B
3% (2)
C
79% (46)
D
5% (3)

Explanation

The most likely cause for not being able to use Real-Time Response to start a session with a host that has a sensor installed is that they do not have an RTR role assigned to them. An RTR (Real Time Response) role is a role that grants access and permissions to use the Real Time Response feature in Falcon, which allows you to remotely access and investigate hosts in real time. There are three types of RTR roles: Real Time Response -Read-Only Analyst, Real Time Response -Active Responder, and Real Time Response -Administrator. You need to have at least one of these roles assigned to you in order to use Real Time Response.

Topics

#Real-Time Response#RTR roles#RBAC#permissions

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice